topic Re: How do I extract numerical value from within a string using rex command? in Splunk Search

How do I extract numerical value from within a string using rex command?

andrewtrobec — Sat, 26 Nov 2016 23:23:17 GMT

Hello,

I've been reading up on the rex command and using it to split strings, but I cannot for the life of me get it working. I have the following input:

FORECAST
Sun and a few passing clouds. High 13C. Winds light and variable.
Partly cloudy. Low 4C. Winds light and variable.
Overcast with rain showers at times. High around 10C. Winds NE at 10 to 15 km/h. Chance of rain 60%.
Cloudy skies. Low 2C. Winds ENE at 10 to 15 km/h.
Partly cloudy skies. High 6C. Winds light and variable.
A mostly clear sky. Low -1C. Winds light and variable.
A mainly sunny sky. High 6C. Winds light and variable.
A mostly clear sky. Low near 0C. Winds light and variable.

and my goal is to extract the temperature value into a new field FORECAST_C. I basically have to remove everything up until the space between the date, and everything after starting with "C.". My desired output is:

FORECAST_C
13
4
10
2
6
-1
6
0

I've come up with

rex field=entry ".\s(<FORECAST_C>.*)C\w."

but it's clearly not working...

Can somebody give me a hand?

Thanks!

Andrew

Re: How do I extract numerical value from within a string using rex command?

gokadroid — Sat, 26 Nov 2016 23:55:03 GMT

If every line is an event try this:

your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If more than one lines are in per event try max_match=0 in it:

your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If the data in question is in field=entry then you can use that field as well in the above commands rather than field=_raw.

See extraction here.

Re: How do I extract numerical value from within a string using rex command?

andrewtrobec — Sun, 27 Nov 2016 00:05:55 GMT

Exactly that! I saw that you revised your answer since I was about to say that I added the \s so that it would take everything after the space, but I see you caught that already!

Thank you!